Since null_fd is used as stdin (not only stdout/stderr), it must be opened as O_RDWR, not O_WRONLY as today.